summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLeon Scroggins III <scroggo@google.com>2015-05-29 16:13:11 -0400
committerWolfgang Wiedmeyer <wolfgit@wiedmeyer.de>2015-10-18 19:07:10 +0200
commit38add157784a2bb5ddb13558573ece99229bb3b0 (patch)
treecad1425d571c9412b53453938a10c4ce9f5ae5c3
parentfeaf84ab8c466f98d42d5a29b54ac273f9e9afde (diff)
downloadframeworks_base-38add157784a2bb5ddb13558573ece99229bb3b0.zip
frameworks_base-38add157784a2bb5ddb13558573ece99229bb3b0.tar.gz
frameworks_base-38add157784a2bb5ddb13558573ece99229bb3b0.tar.bz2
DO NOT MERGE: Ensure that unparcelling Region only reads the expected number of bytes
bug: 20883006 Change-Id: I4f109667fb210a80fbddddf5f1bfb7ef3a02b6ce Conflicts: core/jni/android/graphics/Region.cpp
-rw-r--r--core/jni/android/graphics/Region.cpp7
1 files changed, 6 insertions, 1 deletions
diff --git a/core/jni/android/graphics/Region.cpp b/core/jni/android/graphics/Region.cpp
index 6ba4de2..81c386f 100644
--- a/core/jni/android/graphics/Region.cpp
+++ b/core/jni/android/graphics/Region.cpp
@@ -181,7 +181,12 @@ static SkRegion* Region_createFromParcel(JNIEnv* env, jobject clazz, jobject par
return NULL;
}
SkRegion* region = new SkRegion;
- region->unflatten(regionData);
+ size_t actualSize = region->unflatten(regionData);
+
+ if (size != actualSize) {
+ delete region;
+ return NULL;
+ }
return region;
}